| ID | F0010 |
| Objective(s) | Persistence, Privilege Escalation |
| Related ATT&CK Techniques | Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006) |
| Version | 2.1 |
| Created | 1 August 2019 |
| Last Modified | 12 June 2023 |
Malware may use loadable kernel modules to persist on a system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. Malware may try to hide drivers or modules by creating them without a name.
See ATT&CK: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006).
| Name | ID | Description |
|---|---|---|
| Device Driver | F0010.001 | Allows kernel to access hardware connected to the system. |
| Name | Date | Method | Description |
|---|---|---|---|
| Drovorub | 2020 | -- | Drovorub uses a kernel module rootkit for loading and for persistence. [1] |
[1] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF